DE102007008293A1 - Method and device for secure storage and secure reading of user data - Google Patents

Abstract

User data (ND) are stored in at least one data record (DS) in at least one predetermined, logical data area. The at least one data record (DS) is assigned in each case a data record identifier (DSK) which has a uniqueness stamp which is unique in the respective given data area, a unique data area identifier of the predefined data area in which the respective data record (DS) is stored, and a logical position of the respective data record Record (DS) within the respective predetermined data range includes. For the payload data (ND) and the respectively associated record identifier (DSK) of the respective record (DS), a record check value (DSP) is determined and stored. The respective given data area is assigned a data area information (DBI) which comprises the data area identifier of the respective predefined data area and information about at least one value range of the uniqueness stamp of the data records (DS) currently stored in the respective predetermined data area.

Description

The The invention relates to a method and a device for secured Save and secure reading of user data, in particular in a digital tachograph.

In the WO 2005/098567 A1 an arrangement with an integrated circuit is disclosed. The integrated circuit comprises an encryption unit as a function module by means of which data or program code can be encrypted and decrypted. Furthermore, to protect against manipulation, a safety sensor is provided as a functional module by means of which at least one operating parameter of the integrated circuit can be monitored. A protective layer may be formed on the integrated circuit and monitored. The protective layer must be destroyed in order to mechanically access the structure of the integrated circuit. If the destruction of the protective layer is detected, deletion of the data to be protected is effected.

The The object of the invention is a method and an apparatus for secured storage and a method and apparatus for secure reading of user data that is reliable.

The Task is solved by the characteristics of the independent Claims. Advantageous developments of the invention are characterized in the subclaims.

According to one In the first aspect, the invention is characterized by a method and a corresponding device for the secure storage of Payload. The payload is stored in at least one record in stored at least one predetermined, logical data area. The at least one data set is in each case assigned a data record identifier assigned, the one in the respective predetermined data area unique uniqueness stamp, a unique data area identifier of the predetermined data area in which the respective data record is stored is, and a logical position of each record within of the respective given data area. The record identifier will be saved. To the user data and the respective associated Record ID of the respective record becomes a record check value determined and saved. The respective given data area is assigned a data area information which is the data area identifier of the respective predetermined data area. The data area information also includes information on at least one range of values of Uniqueness stamp currently in the given one Data area stored records. The respective data area information becomes saved safely or securely.

Secure Saving means that the data stored in this way is against manipulation be stored protected. Safe storage takes place preferably in a secure memory in which the data is electrical and / or mechanically protected against manipulation. secured Saving means that the data saved in this way can be checked for manipulation are, for example, by checking a cryptographic determined test value, such as the record test value, or a cryptographically determined digital signature. The saved save has the advantage that the data stored so easy and reliable are verifiable on their integrity and that the data is also not stored in the secure memory Need to become. Because of the generally high price Safe storage, so costs can be saved. The secure or secure storage includes in particular cryptographically secure storage, that means in particular the use of cryptographic keys and / or cryptographic algorithms for warranty safety.

By Providing the record check value is a manipulation of the User data and / or the associated record identifier reliable recognizable. Based on the data area identifier is an exchange of a Record between different predetermined data areas reliably recognizable. Further, by logical Position of the data record within the associated, predefined data area a swapping of records reliably recognizable. Based on the uniqueness stamp and the information on the at least A value range of the uniqueness stamp is a so-called Replay attack reliably recognizable. In a replay attack For example, an old record that has become invalid is, but has a correct record check value, output as a newer record.

By the measures mentioned are saved in the user data. Manipulation of user data is simple and reliable recognizable. Furthermore, the provision of the record identifier allows the record check value and the data area information fast access to the user data and in particular a fast, secure writing and fast, secure reading and checking the user data. Another advantage is that the payload and the record identifier is not stored in the secure storage Need to become.

In an advantageous embodiment, the secure storage of the respective Datenbe includes Reichsinformation to determine at least one data area information of at least one predetermined data area a common or respective Datenbereichsprüfwert and store safely or securely. The advantage is that manipulations of the at least one data area information can be reliably detected. Furthermore, the at least one data area information need not be stored in the secure memory in this way. The secure memory can be formed with a particularly small storage capacity and be correspondingly inexpensive. Furthermore, the integrity of the at least one data area information can be checked easily, quickly and reliably.

In a further advantageous embodiment is the respective predetermined Data area an exclusion list of invalidated records assigned. The particular record that has become invalid is registered in the exclusion list. The exclusion list is saved safely or securely. This can be a replay attack reliable with the invalidated record be prevented. Furthermore, such a deletion of a record possible, which makes it invalid without the Integrity of in the associated, predetermined data area to endanger.

In In this context, it is advantageous if by registering of the respective, invalidated record in the Exclusion list the corresponding uniqueness stamp in the exclusion list is entered or depends on this at least one value range has become invalid Uniqueness stamp entered in the exclusion list or in the exclusion list is extended. This has the advantage of being a Space requirement for the exclusion list is low, in particular when the at least one value range has become invalid Uniqueness stamps. Furthermore, the exclusion list can be so special be searched quickly.

In a further advantageous embodiment is a current timestamp determined and stored in the respective record identifier. Thereby are temporally related records very easy and quickly ascertainable, especially in two or more of the predetermined data areas.

According to one second aspect, the invention is characterized by a method and a corresponding device for the secure reading of user data. The user data of at least one data record is read, which is stored in stored at least one given before, logical data area. A record identifier associated with the at least one record is read, the one in the respective given data area unique uniqueness stamp, a unique data area identifier the predetermined data area in which the respective data record is stored is, and a logical position of each record within of the respective given data area. A record check value is read to the payload and the associated Record identifier of each record is stored. An appropriate one Comparison record check value is determined. One of each predetermined data area associated data area information is read that the data area identifier of the given one Data area and information on at least one value range the uniqueness stamp currently in the given data area stored records. An integrity the user data of the respective read record is checked depending on the respective record identifier, the respective Record check value, the respective comparison record check value and the associated data area information.

secured Reading means that the data read in this way is checked for tampering be, for example, by checking a cryptographic determined test value, such as the record test value, or a cryptographically determined digital signature.

Based of the record check value is a manipulation of the payload and / or the associated record identifier reliable recognizable. Based on the data area identifier is an exchange of a record between different predetermined data areas reliably recognizable. Furthermore, based on the logical position of the record within the associated, predetermined data area a swap reliably recognizable from data records. Based of the uniqueness stamp and the information to the at least A value range of a uniqueness stamp is a so-called replay attack reliably recognizable. For example, a replay attack an old record that has become invalid, however has a correct record check value, as a newer one Record output.

By the measures mentioned are saved the user data read. Manipulating the user data becomes easy and reliable recognized. Furthermore, the record identifier allow the record check value and the data area information provides quick access to the User data and in particular a fast, secure reading and checking the user data.

In an advantageous embodiment of the second aspect, at least one common or respective data area check value of at least one data area information is at least one read predetermined data area. In each case a corresponding common or respective comparison data area check value is determined for the at least one data area information of the at least one predetermined data area. The integrity of the payload data in the respective data set is checked as a function of the at least one read data area check value and the at least one compare data area check value. The advantage is that manipulations of the at least one data area information are reliably detected. Furthermore, the integrity of the at least one data area information can be checked easily, quickly and reliably.

In a further advantageous embodiment of the second aspect is an exclusion list associated with the respective given data area becomes invalid become records after a registration of the respective searched record searched. The integrity of the payload is checked in the respective record depending of those registered in the exclusion list, invalid become records. The the given one Data exclusion list associated with data area becomes secure or secured read, that is from a tamper-proof memory read and / or checked for integrity. In other words, checking includes the integrity of the user data, if necessary, also the checking the integrity of the exclusion list. This can be a replay attack reliable with the invalidated record be prevented. Furthermore, such a deleted record, which has become invalid by deleting, not the integrity of the associated, given Data area stored data.

In In this context, it is beneficial if the integrity the payload in the respective record checked is dependent on the number entered in the exclusion list, become uniqueness uniqueness stamps or dependent uniqueness stamp invalidated by at least one value range, which is entered in the exclusion list. This has the advantage that a space requirement for the exclusion list is low is, in particular when providing the at least one range of values invalidated uniqueness stamp. Furthermore, can the exclusion list will be searched so quickly.

embodiments The invention are explained below with reference to the schematic drawings. Show it:

1 a digital tachograph,

2 a first embodiment of a logical data arrangement,

3 a second embodiment of the logical data arrangement,

4 a record identifier,

5 a data area information,

6 a flowchart of a program for secure storage of user data and

7 a flow diagram of a program for secure reading of user data.

elements the same construction or function are cross-figurative provided with the same reference numerals.

A digital tachograph TCO comprises a secure memory SMEM, a data memory DMEM, a real-time clock RTC and at least one chip card reading unit into which a chip card CK can be inserted, for example a so-called tachograph card or workshop card ( 1 ). The real-time clock RTC is preferably protected against manipulation and can only be set by authorized persons who can identify themselves by a corresponding chip card CK, for example by the workshop card, with respect to the tachograph TCO. The tachograph TCO is coupled to at least one wheel speed sensor RDS for detecting a driving speed of a vehicle in which the tachograph TCO is preferably arranged. The tachograph TCO may also be referred to as a device for writing and / or reading user data ND.

Of the Secure memory SMEM is preferably electrical and / or mechanical protected from manipulation of the data stored in it. For example is the secure memory SMEM with a protective layer or a Security grille provided, the or the electrically monitored is. In case of damage to the protective layer or The security grid can have access to the secure one Memory SMEM stored data can be prevented, for example by deleting the data. The secure memory SMEM can but also be designed differently.

The data memory DMEM is preferably designed to be unsafe, that is to say, in particular, not electrically and / or mechanically protected against manipulation. Due to the generally higher price of the secure memory SMEM compared to the data memory DMEM, the secure memory SMEM has only a small memory capacity compared to the data memory DMEM. However, the data stored in the data memory DMEM should also be protected. In particular, manipulations of the data are reliably detected who you can. The tachograph TCO is therefore designed to store data securely in the data memory DMEM and to read from this secured. The data stored in the data memory DMEM are cryptographically stored for manipulation verifiable and are checked during reading in order to determine the integrity of the read data or to detect tampering.

The Data stored in the data memory DMEM includes the payload ND, for example, include the detected driving speed. The smart card CK may have another secure memory and a further data storage include according to the secure storage SMEM and the data memory DMEM of the tachograph TCO. Corresponding You can also save data in the other data store the chip card CK can be stored or saved read from this.

2 shows a first embodiment of a logical data arrangement of data in the data memory DMEM and the secure memory SMEM. A corresponding logical data arrangement of data can also be provided in the further data memory of the chip card CK and the further secure memory of the chip card CK. At least one predetermined data area for storing at least one data set DS is provided in the data memory DMEM. Exemplary are in 2 a first predetermined data area DB1, a second predetermined data area DB2 and a third predetermined data area DB3 are shown. However, only a predetermined data area can be provided. Furthermore, two or more than three predefined data areas can also be provided.

The different predetermined data areas can for be provided different data types or data structures. However, several predetermined data ranges for the same data type or provided for the same data structure be. Furthermore, it can also be provided, different types of data or data structures together in one of the predetermined data areas save. For example, one of the predetermined data areas be provided for secure storage of the detected vehicle speed as user data ND. Another of the predetermined data areas can be provided for the secure storage of a Einsteckzeitpunkts and Aussteckzeitpunkts the chip card CK in or out of Chip card reading unit of the tachograph TCO as user data ND. It However, other or further user data ND can also be stored become.

The Records DS that can be stored in the specified data areas are each comprise the payload ND, a record identifier DSK and a record check value DSP. The record check value DSP is via the payload ND and the record identifier DSK of the respective data set DS formed. The record check value DSP is preferably formed cryptographically, for example as a digital signature or as a message authentication code, which is also called Message Authentication Code, or MAC for short can be. However, the record check value DSP may also be be trained differently. The record identifier DSK and the record check value DSP are logically assigned to the associated data set DS, but do not have to coincide with the payload ND in the associated, predetermined data area to be stored. The record identifier DSK and the record check value DSP of each record DS can also be on another Location, for example, another disk, stored be.

Of the At least one predetermined data area is preferably as one Ring memory formed with a predetermined maximum number MAX_DS of data sets DS, which are stored in the respective ring buffer, that is in the respective given data area, are storable. The respective ring buffer is characterized from that records DS only to successive, predetermined Positions POS are storable and that when saving the record DS, which is newly stored in the ring buffer, the oldest record DS is overwritten in the ring buffer if the maximum Number MAX_DS of records DS in the respective ring buffer is reached, that is, the respective ring buffer full is. However, the at least one predetermined data area can also be trained differently.

For The Tachograph TCO is the maximum number of MAX_DS records DS prefers so given that the payload ND, within a expected to be stored for a given period, can be stored in the respective ring memories without older ones Records DS must be overwritten. For example, the specified period is one year. However, the given period may be shorter or longer be predetermined.

The respective given data area is in each case assigned a data area information DBI. In the first embodiment, the respective data area information DBI is stored in the secure memory SMEM. As a result, the respective data area information DBI is protected against manipulation. 3 shows a second embodiment of the data arrangement. In the second embodiment of the data arrangement is provided, the to store respective data area information DBI in the data memory DMEM. In order to be able to detect manipulations on one of the data area information DBI, it is provided to determine a data area check value DBP for the respective data area information DBI or jointly for two or more or even all data area information DBI and store it in the secure memory SMEM. As a result, very little storage space is needed in the secure memory SMEM.

4 shows the record identifier DSK. The data record identifier DSK of the respective data record DS comprises a uniqueness stamp ES, a data area identifier DBK and a logical position POS of the respective data record DS within the respective predefined data area. Furthermore, the data record identifier DSK can also include a time stamp ZS, which can preferably be generated by the real-time clock RTC. The uniqueness stamp ES is designed such that it is unique for each data record DS and the respective given data area. This includes that an uniqueness stamp ES already used and invalidated in the associated, predefined data area is not reused for a new data record DS and that a new and unused uniqueness stamp ES is generated and used for a data record DS that was changed. The uniqueness stamp ES is preferably designed as a consecutive number, for example from the set of integers or from the set of natural numbers. However, the uniqueness stamp ES can also be embodied differently, for example as a modified timestamp. The modification is provided to prevent repeated occurrence of the same uniqueness stamp ES when the clock is reset. The data area identifier DBK is a unique reference to the given data area to which the respective data record DS is assigned.

5 shows the data area information DBI. The data area information DBI comprises the data area identifier DBK and information about at least one value range of the uniqueness stamps ES of the data records DS currently stored in the respective predefined data area. This information in particular comprises a uniqueness stamp ES_MIN with the lowest value of all data records DS currently stored in the associated data area. Furthermore, this information can also include a uniqueness stamp ES_MAX with the largest value of all data records DS stored in the associated data area. Due to the uniqueness stamp ES_MIN with the lowest value and the uniqueness stamp ES_MAX with the largest value, a value range of the uniqueness stamp ES is specified. Uniqueness stamps ES are only valid if they are within such a value range. By deleting, changing or adding data records DS to the respective given data area, the information about the at least one value range of the uniqueness stamps ES in the data area information DBI is adapted accordingly. In particular, it can be provided to provide two or more value ranges of the uniqueness stamps ES in the respective data area information DBI if a sequence of the uniqueness stamps ES of the data records DS has one or more gaps in the respective predefined data area. Such a gap may arise, for example, by deleting a DS record or multiple DS records. Delete is also to be understood here as meaning that the data record DS to be deleted is marked as deleted or invalid. For example, the respective data record DS also becomes invalid because its uniqueness stamp ES does not lie within the at least one value range of the uniqueness stamp ES. Several value ranges of the uniqueness stamps ES can be stored or read, for example, as a linked list or as multiple linked lists.

alternative or in addition, an exclusion list AL may be provided assigned to the respective data area information DBI is. In the exclusion list AL are deleted, that is invalidated records DS registered. For this purpose, for example, the respective uniqueness stamp ES in the exclusion list AL registered. It can also be provided a value range of invalidated uniqueness stamps ES for the invalidated record DS in the exclusion list AL or one already in the exclusion list AL entered value range invalidated uniqueness stamp ES depending on the uniqueness stamp ES of that data record DS to be marked as invalid. Thus, a record DS is valid only if its associated uniqueness stamps within the at least a value range of uniqueness stamps ES lies and whose Associated uniqueness stamp It is not in the exclusion list AL is registered. The exclusion list AL is preferably secure or saved to prevent unauthorized manipulation Exclusion list AL to prevent.

Furthermore, it is advantageous to have in the respective data area information a newest position NPOS of the last stored data record DS in the associated, predefined data area and / or a write position SPOS of the position POS to be described next in the associated, predefined data area and / or a number ANZ_DS of DS records currently in the too belonging, predetermined data area are stored, and / or the maximum MAX_DS of records DS, which are storable in the associated, predetermined data area to provide. By providing this information in the respective data area information DBI, the access to the data sets DS of the associated, predefined data area can be effected particularly simply and quickly. However, not all of this information must be provided in the data area information DBI. For example, the maximum number MAX_DS of data sets DS that can be stored in the respective given data area can also be permanently coded in a program that performs the secure writing and / or reading. Furthermore, if appropriate, the writing position SPOS can be determined from other information, in particular if the at least one predetermined data area is designed as a ring memory. For example, as the writing position SPOS, the position POS following the newest position NPOS can be determined taking into account the maximum number MAX_DS of data records DS. Further, if necessary, the uniqueness stamp ES_MAX having the largest value can be determined depending on the latest position NPOS and the writing position SPOS, and therefore need not be provided. Further, if necessary, the newest position NPOS and the write position SPOS may not be provided if the number ANZ_DS of data sets DS is provided in the associated predetermined data area.

6 shows a flowchart of a program for secure writing of user data ND. The program starts in a step S1. In a step S2, the user data ND is stored in at least one data record DS. The respective data record DS is assigned to a predetermined data area. This assignment takes place, for example, depending on the data type or the data structure of the user data ND to be stored. In a step S3, the respective data record identifier DSK is generated and stored for the respective data record DS. In a step S4, it may be provided to generate the time stamp ZS and to store it in the respective data record identifier DSK.

In a step S5 is the respective record check value DSP depending on the respective user data ND and the respective Record ID DSK determined. The respective record check value DSP is stored for the respective DS record. In a step S6, the respective data area information DBI of the respectively associated, predetermined data area and stored or, if already stored, updated. This concerns in particular the information about the at least one Value range of the uniqueness stamp ES and, if applicable, the latest position NPOS, the writing position SPOS and / or the number ANZ_DS of records DS. Storing the data area information DBI is preferably carried out safely in the secure memory SMEM or saved in the data store DMEM. In the latter case, in one step S7 the respective or common data area check value DBP is generated and stored securely in the secure memory SMEM. The program ends in a step S8.

It can also be provided a step S9, for example, instead Steps S2 to S5 is executed to a record DS or delete two or more DS records or mark as invalid. The respective record For example, DS will be included in the designated exclusion list AL registered, for example by entering the respective uniqueness stamp ES or by entering or adjusting one or more value ranges Value ranges invalidated uniqueness stamp IT.

Based The data thus stored is an integrity of the payload ND verifiable. A manipulation of user data ND or data record identifier DSK and / or possibly data area information DBI, that is a violation of integrity the user data ND, is so recognizable. The checking takes place in the secure reading of the user data ND.

7 shows a flowchart of a program for secure reading of user data ND. The program starts in a step S10. In a step S11, the payload data ND to be read is read from the respective data sets DS. Furthermore, the data record identifier DSK of the respective associated data set DS is read in a step S12. In a step S13, the respective data record check value DSP of the respective data set DS is read. Furthermore, depending on the read user data ND and the respectively associated data record identifier DSK, a respectively associated comparison data record test value VDSP is determined. The determination of the comparison data record check value VDSP is preferably carried out in the same way as the determination of the record check value DSP in the saved memory of the user data ND. However, this depends on the type of record check value DSP. Furthermore, in a step S14, it is possible to read the exclusion list AL, which is assigned to the data area information DBI of the associated predefined data area, and, if necessary, to check its integrity.

In a step S15, it is checked whether the comparison data set check value VDSP is equal to the record check value DSP. Furthermore, it can be checked in step S15 whether the respective data record DS is registered in the exclusion list AL. Is the ermit If the comparison data record check value VDSP is different from the respective data record check value DSP or if the respective data record DS is registered in the exclusion list AL, then the program is continued in a step S16 in which it is determined that the integrity of the user data ND has been violated. The program then ends in a step S17.

is however, in step S15, the comparison data set check value VDSP is equal to the record check value DSP and is the respective one Record DS is not registered in the exclusion list AL, then becomes the program continues in a step S18. In the step S18 is the data area information DBI of the associated, read predetermined data area. If necessary, it is in one Step S19, the respective or common data area check value DBP and a compare data range check value Determine VDSP according to the data area check value DBP. In a step S20 it is checked whether the information in the record identifier DSK and in the data area information DBI are plausible. For example, it checks whether the uniqueness stamp stored in the record identifier DSK ES within the at least one value range of the uniqueness stamp IT is up. It is also checked whether the data area identifier DBK matches. It is also preferable to check whether the respective position POS, that in the respective record identifier DSK is stored, each of the actual position POS of the respective data record DS in the respectively associated, given data range corresponds. It can also be checked whether the comparison data area check value VDBP is equal to Data area check value DBP is. Is the information in the record identifier DSK and the data area information DBI not plausible or agree the comparison data range check value VDBP and data range check value DBP do not match, then the program continues in step S16 and in the Step S17 ends. Otherwise, the program will be in one step S21 continued, which states that integrity the user data ND is given and these are not likely were manipulated. The program ends in step S17.

A sequence of the respective steps of the programs according to 6 and 7 can also be designed differently. For example, a reading order of the user data ND, the record identifier DSK, the data area information DBI, the record check value DSP and the data area check value DBP is irrelevant. Further, a check order may be different, that is, checks in steps S15 and S20 may be performed in a different order. Accordingly, a write order of the user data ND, the record identifier DSK, the data area information DBI, the record check value DSP and the data area check value DBP is irrelevant.

By the secure storage of the user data ND and the secured Reading the user data ND are easy manipulations of the user data ND and reliably recognizable. The recognizable manipulations include changes to the payload ND, to the record identifier DSK and possibly at the data area information DBI. Further The manipulations can change the position POS of records DS within their associated predetermined data area, an exchange of data sets DS between different predetermined data areas and a replacement of data area information. Furthermore, so-called Replay attacks detectable by providing the uniqueness stamp ES and taking into account the information on the at least a value range of uniqueness stamps ES within the associated, given data area.

One The advantage is that only small data volumes require computation, Cryptographic calculations must be performed for determining the respective record check value DSP and comparison data set test value VDSP and, if applicable for determining the respective or common data area check value DBP and compare data range check value VDBP. simulations have shown that a period of time required for integrity must be spent by the secured letter or the secure reading according to the above for large amounts of data about a factor of two to three can be reduced. An access to a respective record DS, that is the secured letter or the secured one Reading the respective data record DS, can be done very quickly. The secure writing and the secure reading according to the The above statements are especially advantageous in particular. if the saved records DS no or are subject to only rare changes.

The secured letters and / or secure reading in accordance with The above is not only in the tachograph TCO available. Other devices in the automotive sector, for example control devices, or in another technical area can also benefit from the secure writing and / or secure reading. For example can also program code and / or maps and / or others Data written as the user data ND secured accordingly and / or to be read.

AL

exclusion list

ANZ_DS

number of records

CK

smart card

DB1

first given data area

DB2

second given data area

DB3

third given data area

DBI

Data area information

DBK

The data area identifier

DBP

Datenbereichsprüfwert

DMEM

data storage

DS

record

DSK

Record ID

DSP

Datensatzprüfwert

IT

uniqueness stamp

ES_max

uniqueness stamp with greatest value

ES_MIN

uniqueness stamp with lowest value

MAX_DS

maximum Number of records

ND

payload

NPOS

latest position

POS

position

RDS

wheel speed sensor

RTC

Real Time Clock

S1-S21

step

SMEM

secure Storage

SPOS

write position

TCO

tachograph

VDBP

Vergleichsdatenbereichsprüfwert

VDSP

Vergleichsdatensatzprüfwert

ZS

time stamp

QUOTES INCLUDE IN THE DESCRIPTION

This list The documents listed by the applicant have been automated generated and is solely for better information recorded by the reader. The list is not part of the German Patent or utility model application. The DPMA takes over no liability for any errors or omissions.

Cited patent literature

• WO 2005/098567 A1 [0002]

Claims (11)

Method for the secure storage of user data (ND), in which - the user data (ND) in at least one Record (DS) in at least one predetermined, logical data area get saved, - the at least one record (DS) is assigned a respective record identifier (DSK), which comprises a unique uniqueness stamp in the respective given data area (ES), a unique data area identifier (DBK) of the given Data area in which the respective data record (DS) is stored, and a logical position (POS) of the respective data record (DS) within the respective given data area, and the record identifier (DSK) is stored, - to the user data (ND) and the respectively associated data record identifier (DSK) of the respective Record (DS) determines a record check value (DSP) and is stored and - the respective given Data area is assigned a data area information (DBI), the data area identifier (DBK) of the respective given data area and information on at least one range of uniqueness stamps (ES) of the currently stored in the respective predetermined data area Records (DS), and the respective data area information (DBI) saved safely or securely. The method of claim 1, wherein the secured Storing the respective data area information (DBI), at least one data area information (DBI) at least one predetermined data range a common or respective Datenbereichsprüfungswert (DBP) and store it safely or securely. Method according to one of the preceding claims, in which - the respective given data area An exclusion list (AL) of invalidated records (DS) is assigned, - the respective data record (DS), which has become invalid in the exclusion list (AL) is registered and - the exclusion list (AL) sure or saved. Method according to claim 3, wherein by registering of the respective, invalidated data set (DS) in the exclusion list (AL) the associated uniqueness stamp (ES) is entered in the exclusion list (AL) or dependent invalidated by this at least one value range Uniqueness stamp (ES) entered in the exclusion list (AL) or in the exclusion list (AL). Method according to one of the preceding claims, in which a current time stamp (ZS) determined and in the respective Record ID (DSK) is stored. Method for the secure reading of user data (ND), in which - the payload (ND) of at least one record (DS) be read in at least one given, logical Data area are stored, - one at least read a record record (DSK) associated with a record (DS) which includes one in the respective predetermined data area unique uniqueness stamp (ES), a unique data area identifier (DBK) of the predetermined data area in which the respective data record (DS) is stored, and a logical position (POS) of the respective Data record (DS) within the respective given data range, - one Record Check Value (DSP) is read to the payload (ND) and the associated record identifier (DSK) of the respective Record (DS) is stored, and a corresponding comparison record check value (VDSP) is determined - one of the given Data area associated data area information (DBI) read which is the data area identifier (DBK) of the given one Data area and information on at least one value range the uniqueness stamp (ES) currently in the given Data area stored records (DS) includes, and - one Integrity of the user data (ND) of the respective read Record (DS) is checked depending on the respective record identifier (DSK), the respective record check value (DSP), the respective comparison data set check value (VDSP) and the associated data area information (DBI). The method of claim 6, wherein - at least a common or respective data area check value (DBP) at least one data area information (DBI) at least one given data range is read, - each a corresponding common or respective comparison data area check value (VDSP) to the at least one data area information (DBI) of the at least one predetermined data area is determined and - the Integrity of the user data (ND) in the respective data record (DS) is checked depending on the at least a read data area check value (DBP) and the at least a comparison data area check value (VDSP). Method according to one of Claims 6 or 7, in which - an exclusion list (AL) of invalid data records (DS) associated with the respective given data area is registered after registration of the respective The integrity of the user data (ND) is checked in the respective record (DS) is dependent on the in the exclusion list (AL) registered, invalidated records (DS). The method of claim 8, wherein the integrity the user data (ND) in the respective record (DS) checked is dependent on in the exclusion list (AL) registered, become uniqueness uniqueness stamps (ES) or dependent Uniqueness stamps that have become invalid by at least one value range (ES), which is entered in the exclusion list (AL). Device for the secure storage of user data (ND), which is trained - to save the user data (ND) in at least one data set (DS) in at least one predetermined, logical data area, - for the respective assignment a record identifier (DSK) to the at least one record (DS), the one in the given data area unique Uniqueness stamp (ES), a unique data area identifier (DBK) of the specified data area in which the respective data record (DS) is stored, and a logical position (POS) of the respective Data set (DS) within the respective given data range and storing the record identifier (DSK), - to the Determining a record check value (DSP) for the payload (ND) and the associated record identifier (DSK) of the respective data set (DS) and for storing the respective Record Check Value (DSP) and - to assign a data area information (DBI) to the respective predetermined Data area, which includes the data area identifier (DBK) of the respective predetermined data area and information on at least one range of values the uniqueness stamp (ES) currently in the given Data area stored records (DS), and to secure or secure storage of the respective data area information (DBI). Device for secure reading of user data (ND), which is trained - for reading the user data (ND) of at least one data set (DS) that is contained in at least one predetermined, logical data area are stored, - to the Reading a record identifier associated with the at least one record (DS) (DSK), which includes one in the respective predetermined data area unique uniqueness stamp (ES), a unique data area identifier (DBK) of the predetermined data area in which the respective data record (DS) is stored, and a logical position (POS) of the respective Data record (DS) within the respective given data range, - to the Reading a record check value (DSP), which is the payload (ND) and the associated record identifier (DSK) of the respective Record (DS) is stored, and to determine a corresponding Comparison data record test value (VDSP), - to the Reading a data area assigned to the respective given data area Data area information (DBI) that contains the data area identifier (DBK) of the given data area and information on at least a range of uniqueness (ES) stamps currently in data records (DS) stored in the respective given data area includes, and - to check one Integrity of the user data (ND) of the respective read Record (DS) depending on the respective record identifier (DSK), the respective record check value (DSP), the respective Comparison Record Check Value (VDSP) and the associated Data area information (DBI).